DBAG invests in cybersecurity tester Bug Bounty Switzerland

Frank­furt am Main — Deut­sche Betei­li­gungs AG (DBAG) has acqui­red a mino­rity stake in Bug Bounty Switz­er­land AG (BBS). The invest­ment is part of a long-term parti­ci­pa­tion and is made exclu­si­vely with funds from DBAG’s balance sheet. BBS, based in Lucerne, is the Swiss pioneer for ethi­cal hack­ing, intel­li­gent secu­rity test­ing and the service-as-soft­­ware model. DBAG, toge­ther with lead inves­tor Diret­tis­sima Growth Part­ners, is inves­t­ing as part of a capi­tal increase, which will be used exclu­si­vely for the further growth of the company. Diret­tis­sima is a Euro­pean growth equity inves­tor based in Zurich and Munich with opera­tio­nal scale-up expe­ri­ence in the B2B tech­no­logy sector. 

With the Cyber Resi­li­ence Shield secu­rity plat­form, BBS enables its custo­mers to carry out conti­nuous, scalable secu­rity assess­ments of their entire expo­sed attack surface without inter­nal specia­lists or frag­men­ted indi­vi­dual solu­ti­ons. Human+Machine: Bug Bounty Switz­er­land combi­nes 16,000 experts with AI tech­no­logy to provide orga­niza­ti­ons and compa­nies with a strong phalanx against poten­tial cyber­se­cu­rity risks. 

Stra­te­gic invest­ment in a fast-growing cyber­se­cu­rity provider

With its invest­ment in BBS, DBAG is expan­ding its port­fo­lio to include a profi­ta­ble, highly scalable provi­der in the struc­tu­rally growing cyber­se­cu­rity market. The company was foun­ded in 2020 by Sandro Nafzger, Florian Badert­scher and Lukas Hepp­ler in Lucerne and was built up enti­rely on its own without exter­nal finan­cing. BBS has successfully made the tran­si­tion from a project-based service model to the Cyber Resi­li­ence Shield subscrip­tion plat­form with a high propor­tion of recur­ring reve­nue. BBS now has around 52 custo­mers, inclu­ding the fede­ral govern­men­t’s Natio­nal Cyber Secu­rity Center (NCSC) and leading compa­nies in the finan­cial services, defense and criti­cal infra­struc­ture sectors. The foun­ding team conti­nues to hold the majo­rity of shares and plays a key role in shaping the stra­te­gic direction. 

Invest­ments from balance sheet funds enable long-term partnerships

DBAG’s long-term invest­ment stra­tegy focu­ses on mino­rity share­hol­dings for which funds are used exclu­si­vely from the company’s own balance sheet. This enables a holding period that extends beyond the usual term of a private equity fund invest­ment and offers grea­ter flexi­bi­lity in the stra­te­gic orien­ta­tion and growth support of the port­fo­lio compa­nies. To date, DBAG has inves­ted in six other compa­nies as part of this invest­ment stra­tegy, one of which has alre­ady been sold in full and another partially. 

Intel­li­gent secu­rity tests for the AI era

BBS addres­ses one of the most pres­sing struc­tu­ral chal­lenges of digi­ta­liza­tion: with the incre­asing use of AI, attack surfaces, attack speed and attack comple­xity are incre­asing simul­ta­neously. BBS meets this deve­lo­p­ment with a proprie­tary service-as-soft­­ware approach that consis­t­ently combi­nes human and machine intel­li­gence: The plat­form orchestra­tes over 16,000 vetted ethi­cal hackers and AI agents in a closed loop that conti­nuously models, tests and evalua­tes each custo­mer’s attack surface. This provi­des compa­nies with long-term active protec­tion. The decisive compe­ti­tive advan­tage lies in the orchestra­tion level, the regu­la­tory work­flows and the accu­mu­la­ted insti­tu­tio­nal test­ing know­ledge. Combi­ned, this is a stra­te­gic advan­tage that is struc­tu­rally diffi­cult to repli­cate. In addi­tion, Bug Bounty Switz­er­land not only offers test­ing proce­du­res, but above all trans­pa­rency. Findings are conti­nuously trans­la­ted into the respec­tive corpo­rate context and the corre­spon­ding risk assess­ments. This means that all rele­vant demand groups remain capa­ble of acting. 

Tom Alzin, CEO, Deut­sche Betei­li­gungs AG, says: “BBS is addres­sing a market that is getting bigger, not smal­ler, thanks to AI. The company controls precis­ely the part of the value chain that no auto­ma­tion has been able to replace so far: the orchestra­tion of the entire secu­rity test­ing program, embedded in the speci­fic context of each custo­mer. The fact that BBS has built up this model comple­tely and profi­ta­bly on its own is a strong quality feature. We see this as a long-term part­ner­ship with considera­ble poten­tial for added value.” 

“BBS combi­nes three things that rarely come toge­ther: a diffe­ren­tia­ted product built on years of proprie­tary know-how and data, profi­ta­ble opera­ti­ons from the start without exter­nal funding, and a market where conti­nuous cyber­se­cu­rity test­ing of best prac­tice is beco­ming the stan­dard. The team has earned the privi­lege of rede­fi­ning and leading this cate­gory,” says Phil­ipp Bolli­ger, Part­ner at Diret­tis­sima Growth Partners. 

Growth poten­tial in a struc­tu­rally growing market

The global market for cyber­se­cu­rity test­ing is growing at an annual rate of 25% (USD 14.7 billion in 2024 to an expec­ted USD 43.9 billion in 2029). This is driven by incre­asing regu­la­tion, parti­cu­larly in the finan­cial services, defense and criti­cal infra­struc­ture sectors, as well as the expan­sion of attack surfaces due to AI and the struc­tu­ral shift from selec­tive to conti­nuous secu­rity solu­ti­ons. Accor­ding to a recent market study by Houli­han Lokey, 91% of the compa­nies surveyed plan to increase their spen­ding on cyber secu­rity in 2026. Cyber­se­cu­rity is conside­red to be one of the areas that will bene­fit struc­tu­rally from AI deve­lo­p­ment instead of being disrupted. 

“While AI is funda­men­tally rede­fi­ning cyber secu­rity, orga­niza­ti­ons need protec­tion that is conti­nuous, intel­li­gent and easy to use. That’s exactly what we’re alre­ady deli­ve­ring to some of Euro­pe’s most secu­rity-conscious orga­niza­ti­ons — and now we’re brin­ging it to market globally. With the support of Diret­tis­sima and DBAG, we are making intel­li­gent secu­rity test­ing the new stan­dard,” says Sandro Nafzger, CEO & Co-Foun­­der of Bug Bounty Switz­er­land AG.

Inter­na­tio­na­liza­tion and scaling as the next growth phase

Toge­ther with the manage­ment and lead inves­tor Diret­tis­sima Growth Part­ners, DBAG plans to profes­sio­na­lize the orga­niza­tion, acce­le­rate growth in Switz­er­land and deve­lop inter­na­tio­nal markets. In parti­cu­lar, DBAG will contri­bute its access to the German-spea­king and Italian regi­ons and its exper­tise in scaling high-growth companies.